Hi, I have a Cisco ISR family router with IOS version 15.1 which has AAA enabled. One of the "aaa" configuration commands is "aaa session-id common" which according to Cisco documentation "ensures that all session identification (ID) information that is sent out for a given call will be made identical". However, when I check the debug output of TACACS+ server(pro-bono TACACS+ version 201603291913), then session IDs are frequently changed. For example here I telnet into router and provide TACACS+ username and password:
4509: 10:53:08.264 0/e488579d: session id: 9d5788e4 data length: 24 4509: 10:53:08.264 0/e488579d: AUTHEN/START, priv_lvl=1 4509: 10:53:14.201 0/e488579d: session id: 9d5788e4 data length: 10 4509: 10:53:14.201 0/e488579d: AUTHEN/CONT user_msg_len=5, user_data_len=0 4509: 10:53:19.929 0/e488579d: session id: 9d5788e4 data length: 10 4509: 10:53:19.929 0/e488579d: AUTHEN/CONT user_msg_len=5, user_data_len=0 4509: 10:53:19.937 1/3fdc5a70: session id: 705adc3f data length: 48 4509: 10:53:19.937 1/3fdc5a70: AUTHOR priv_lvl=1 authen=1 method=tacacs+ (6) svc=1 4509: 10:53:19.950 2/69d08d1f: session id: 1f8dd069 data length: 69 4509: 10:53:19.950 2/69d08d1f: ACCT flags=0x2 method=6 priv_lvl=15 type=1 svc=1 As seen above, authentication, authorization and accounting parts of the process did not share the same session ID. Behavior is exactly the same as in case of "aaa session-id unique". In addition, if I execute for example "sh run" three times, then again, accounting session IDs are changed three times both in case of "aaa session-id common" and "aaa session-id unique". In a nutshell, I'm not able to see any difference between "aaa session-id common" and "aaa session-id unique". What exactly should this "aaa session-id common" do? I thought that it keeps the same session ID throughout authentication, authorization and accounting in order to associate sessions in TACACS+ log files easily. Or at least keeps the same session ID per authentication, authorization and accounting service. thanks, Martin _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
